Skip to content

Clarify cron and connector JWT guidance in app skills #172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rishikesh-major wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −10
Open

Clarify cron and connector JWT guidance in app skills #172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 3 additions & 9 deletions plugins/major-build/skills/app-builder/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,17 +73,11 @@ Two playbooks — use the relevant one before you start:

## Recurring work

Apps no longer carry their own crons. `cron.json` is not read. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.
For recurring work, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.

## Calling go-api from app code
## Using connectors

Do not construct `PostgresResourceClient`, `SlackResourceClient`, `createProxyFetch`, or any other resource client by hand. Import the generated client in `clients/`. It already copies the incoming `x-major-user-jwt`.

A resource call to go-api without `x-major-user-jwt` will be rejected. A hand-rolled client that only sets `MAJOR_JWT_TOKEN` fails, including from a webhook or a workflow `app_call`.

A webhook route and a workflow `app_call` are real requests. Ingress has already set `x-major-user-jwt`. `headers()` works there. Do not drop `getHeaders` so those routes can run.

`MAJOR_JWT_TOKEN` alone is only for the runner and for code that is not inside a request. `current-build` and the error reporter keep using it.
When calling connectors from an app, you must forward the `x-major-user-jwt` headers. Generated clients already pull it from header context. Without the `x-major-user-jwt` header, connector client calls will fail with insufficient permissions. When developing locally or in sandbox, we use the local `MAJOR_JWT_TOKEN` instead. This is sufficient only during development and will fail in production without `x-major-user-jwt`.

## LLM calls from app code

Expand Down
2 changes: 1 addition & 1 deletion plugins/major-build/skills/using-connectors/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ description: Use for ANY operation against a connected resource or connector —

The organization's connectors are _resources_ — external services (databases, APIs, storage, etc.) the agent and its apps reach through Major's secure clients and MCP tools. Every connector is used the same way: find the resource, read its context docs, then follow that connector's reference in this skill.

App code imports the generated client in `clients/`. Do not construct a client with only `majorJwtToken`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header.
When calling connectors from an app, you must forward the `x-major-user-jwt` headers. Generated clients already pull it from header context. Without the `x-major-user-jwt` header, connector client calls will fail with insufficient permissions. When developing locally or in sandbox, we use the local `MAJOR_JWT_TOKEN` instead. This is sufficient only during development and will fail in production without `x-major-user-jwt`.

## Step 1: List available resources

Expand Down
Loading